resolver, watcher: a domain's nameservers are only its own delegation (closes #222)

When a domain's parent zone's servers answer NXDOMAIN, LookupNS returns
ErrNXDomain. The watcher then saves the domain with no nameservers and
nxdomain set, shown on the dashboard and in /api/v1/status, asks for none
of its records and removes those saved, so its old nameservers go in one
NS Change. A domain with no delegation of its own gets an empty set and
its records are still asked at the zone it is in.
FindAuthoritativeNameservers moves to a parent name only on one of those
two answers; when the servers do not answer, it returns the error. After
an upgrade, a domain without its own delegation that was saved with its
parent zone's nameservers gets one NS Change; the README says so.

Model: opus-5-5

internal/handlers/templates/dashboard.html

@@ -84,7 +84,11 @@
                   {{ $name }}
                 </td>
                 <td class="py-2 px-3 text-slate-400 break-all">
+                  {{ if $ds.NXDomain }}
+                  <span class="text-red-400">does not exist</span>
+                  {{ else }}
                   {{ joinStrings $ds.Nameservers ", " }}
+                  {{ end }}
                 </td>
                 <td class="py-2 px-3 text-slate-500 whitespace-nowrap">
                   {{ relTime $ds.LastChecked }}